Stripe: Create an ephemeral key

← Ephemeral keys operations · Get started

Operation stripe.postephemeralkeys

Provider route: POST /v1/ephemeral_keys. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/stripe with npm, or alter-sdk-stripe with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { StripeIntegration } from "@alter-ai/stripe";

async function execute(input: Parameters<StripeIntegration["ephemeralKeys"]["postEphemeralKeys"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new StripeIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.ephemeralKeys.postEphemeralKeys(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_stripe import StripeIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = StripeIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.ephemeral_keys.post_ephemeral_keys(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
headers	object	Optional	Additional keys: not allowed
headers.Idempotency-Key	string	Optional	Minimum length: 1 Maximum length: 255
body	object	Optional	Additional keys: not allowed
body.customer	string	Optional	The ID of the Customer you’d like to modify using the resulting ephemeral key. Maximum length: 5000
body.expand	array	Optional	Specifies which fields in the response should be expanded.
body.expand[]	string	Each item	Maximum length: 5000
body.issuing_card	string	Optional	The ID of the Issuing Card you’d like to access using the resulting ephemeral key. Maximum length: 5000
body.nonce	string	Optional	A single-use token, created by Stripe.js, used for creating ephemeral keys for Issuing Cards without exchanging sensitive information. Maximum length: 5000
body.verification_session	string	Optional	The ID of the Identity VerificationSession you’d like to access using the resulting ephemeral key Maximum length: 5000

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Create an ephemeral key — response body

Referenced models: Create an ephemeral key — response body

Schemas

Create an ephemeral key — response body

Field	Type	Presence	Description and constraints
$	object	Root	Ephemeral keys give the SDKs (like Stripe's mobile SDKs and Issuing Elements) temporary, scoped access to a specific resource, such as a Customer, Issuing Card, or Identity VerificationSession, without exposing your secret API key. Related guides: [Using Issuing Elements](https://docs.stripe.com/issuing/elements).
created	JSON	Required within parent
created (anyOf 1)	integer	Alternative	Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time
created (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
expires	JSON	Required within parent
expires (anyOf 1)	integer	Alternative	Time at which the key will expire. Measured in seconds since the Unix epoch. Format: unix-time
expires (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
id	string	Required within parent	Unique identifier for the object. Maximum length: 5000
livemode	boolean	Required within parent	If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`.
object	string	Required within parent	String representing the object's type. Objects of the same type share the same value. Known values: ephemeral_key
secret	string	Optional	The key's secret. You can use this value to make authorized requests to the Stripe API. Maximum length: 5000

Policy, approvals and errors

SDK function policy ID: stripe.postephemeralkeys. Catalog operation: PostEphemeralKeys. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"Stripe-Version": "2026-09-30.endive"}

Official provider source